Kubernetes is a very popular and powerful tool harnessing containers to run jobs. These containers are normally unique to a specific application and are created and stored ‘in-house’ by organisations, so making sure that the correct container is used to run the correct job is always important.

After all what would happen if the container used to run a job introduced issues or was compromised?

During a recent client engagement to deliver a strategic digital container platform on a global scale, this requirement was surfaced – how do we identify, report and manage container-level vulnerabilities within the applications deployed on the new platform?

Being the first platform of its type in the customer organisation, no guidelines or patterns existed for the use of application containers, meaning the required solution would also form the basis for the enablement and development of the organisation’s wider AWS container security patterns.  Due to the nature of the customer (highly regulated), any solution developed also included the requirement to provide segregation of platform roles and responsibilities, including the enforcement of controls around deployment, promotion and acceptance of images.

Aside from the technical challenges to delivering such a tool, one of its main goals would also be to enable the wider adoption and accelerate migration on to the new strategic container platform through developer focused workflows and early development lifecycle feedback, increasing developer productivity, application quality and the security of the platform as whole.

The solution operates as a centralised container storage and scanning solution, extending the standard AWS ECR service to provide a multi-tenanted, application-agnostic platform.

Key features of the solution include:

• CI/CD driven user workflows for automated image scanning, reporting and promotion
• Segregation of scanned, approved images, distinct from unscanned or rejected images
• Enforced controls around the deployment of images into environments based on scan result criteria
• Centralised vulnerability policy creation and management
• Integration into pre-existing customer-specific reporting and management tools

From a consumer perspective, the solution offers the following interactions:

• Application developers are able to push their images to a central ECR location and benefit from automated scanning, reporting and image promotion or rejection based on criteria defined and managed by the organisation’s cyber security function. Provided Jenkins libraries, Terraform modules and well-defined documentation improve the developer experience by enabling CI/CD of images through the image scanning processes, and providing off-the-shelf infrastructure templates to reduce the time-to-start of application teams.
• Business consumers are able to view, filter and report on the security standpoint and state of vulnerability compliance for all application containers and teams.
• Security teams are able to define, manage and enforce policies for the acceptance and categorisation of vulnerabilities. Vulnerabilities can be managed and either accepted or rejected at an organisation or team level.